What Sony's Robot Dog Teaches Us About Biometric Data Privacy

I'm watching Aibo, Sony's robo-dog, scuttle around the office. Its mechanical joints make slow, noisy work of it on the concrete floor, but I can't help but be mildly heart-warmed. I'd rather have a real dog here, but there's something charming about Aibo.

This is part of a CNET special report exploring the benefits and pitfalls of facial recognition.

James Martin/CNET

The $2,900 pup is a companion robot, one Sony claims "learns its environment and develops relationships with people." Aibo even enlists a camera in its nose to scan faces and determine who's who so it can react to them differently.

So Aibo's out in the land of Lincoln, but the story doesn't stop with Sony's quirky robot. Illinois also limits access to facial recognition in home security cameras, a feature that's becoming increasingly prevalent in the consumer security market. Let's take a closer look at BIPA, the growth of biometric tech in consumer products -- and how other states in the US treat your biometric info.

Due to state regulations and policies, the Aibo™ robotic companion is not for sale or use in Illinois.

In order to mimic the behavior of an actual pet, an Aibo device will learn to behave differently around familiar people. To enable this recognition, Aibo conducts a facial analysis of those it observes through its cameras. This facial-recognition data may constitute "biometric information" under the law of Illinois, which places specific obligations on parties collecting biometric information. Thus, we decided to prohibit purchase and use of Aibo by residents of Illinois.

While Sony simply opted out of selling the face-detecting Aibo in Illinois, other companies, like Nest, sell their facial recognition-enabled cams in Illinois, with the facial recognition feature disabled.

A quick visit to the Nest Cam IQ Indoor page says "Familiar face alerts require a Nest Aware subscription. Not available on Nest Cams used in Illinois."

The Nest Cam IQ Indoor has an optional feature called familiar face alerts that you pay a monthly (or yearly) fee to access via the Nest Aware service. Like many other home security cameras with facial recognition, the IQ Indoor allows you to create a database with the faces of friends, family members, caregivers and any other people that regularly visit your home. That way, when you get a motion alert, the Nest app tells you it sees "Molly" or "Tyler."

That feature won't work in Illinois, even if you pay for Nest Aware. Google disables Nest's facial recognition capabilities in the state: "We use a variety of factors to determine a user's location, including IP address of their devices and the physical address associated with their account," a Google spokesperson told me over email.

Privacy talk

Although BIPA remains the strictest state privacy law, Texas and Washington also regulate biometric information. A Texas law, established in 2009, similarly defines biometric identifiers as "a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry."

A section of the law states: "A person may not capture a biometric identifier of an individual for a commercial purpose unless the person: informs the individual before capturing the biometric identifier; and receives the individual's consent to capture the biometric identifier."

Washington's 2017 House Bill 493 doesn't specifically reference face or hand scans in its definition of biometric identifier. The definition also doesn't include "a physical or digital photograph, video or audio recording or data generated therefrom, or information collected, used, or stored for health care treatment, payment, or operations under the federal health insurance portability and accountability act of 1996."

"When you start to capture biometrics from people it turns a corner to where we think that shouldn't be happening without the consent of the person who's biometrics are being taken," EFF senior staff attorney Adam Schwartz says during a phone interview while referencing Illinois' Biometric Information Privacy Act.

"What it says [BIPA] is that, one private person can't take biometrics from another private person without their consent. And that's where we [the EFF] would draw the line," Schwartz adds.

Now playing:
Watch this:
Facial recognition: Get to know the tech that gets to...

5:11

The facial recognition landscape

At the same time that states are implementing biometric privacy laws, we're seeing more consumer devices with facial recognition. Here's a list of home security cameras you can buy today with facial recognition capabilities.

Airports are increasingly adding tech that scans faces or fingerprints to determine who you are, too. Schwartz refers to the growing popularity of biometric tech as a "normalization of biometrics," something the EFF finds concerning, he says.

"If you start using biometrics to board your airplane because it's convenient, other forms of biometrics seem more normal. We're very concerned about that," explains Schwartz.

Whether or not you're personally concerned about your biometric data, expect to see more regulations around it in the coming years. Alaska, Michigan, Montana and New Hampshire are already working on their own biometric laws. And, given the influx of devices that use biometric information both for consumer and commercial purposes, more are probably on the way.